@mycadet/assistant 0.12.7 → 0.12.9

package/src/runtime/routes/__tests__/ps-routes.test.ts

@@ -22,8 +22,8 @@ mock.module("../../../util/process-tree.js", () => ({
   },
   buildProcessTree: (_procs: ProcInfo[], rootPid: number): ProcTreeNode => ({
     pid: rootPid,
-    name: "assistant.ts",
-    command: "bun run assistant.ts",
+    name: "daemon-main",
+    command: "bun run /app/daemon/main.ts",
     origin: "workspace",
     children: [
       {
@@ -81,7 +81,9 @@ describe("ps route handler", () => {
 
     expect(processes).toHaveLength(1);
     const root = processes[0];
-    expect(root.name).toBe("assistant.ts");
+    // The route must surface the daemon's node as "assistant", not the
+    // entry-script name the tree builder derives ("daemon-main").
+    expect(root.name).toBe("assistant");
     expect(root.status).toBe("running");
     expect(root.info).toBe(`pid ${process.pid}`);
     expect(root.children).toHaveLength(2);

package/src/runtime/routes/__tests__/roadmap-routes.test.ts

@@ -9,14 +9,14 @@ import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 import { UnprocessableEntityError } from "../errors.js";
 import type { RouteDefinition } from "../types.js";
 
-let platformBaseUrl = "https://cloud.mycadet.ai";
+let cloudBaseUrl = "https://cloud.mycadet.ai";
 
 // Spread the real module: replacing it wholesale strips the other exports the
 // route graph pulls in.
 const actualEnv = await import("../../../config/env.js");
 mock.module("../../../config/env.js", () => ({
   ...actualEnv,
-  getPlatformBaseUrl: () => platformBaseUrl,
+  getCloudBaseUrl: () => cloudBaseUrl,
 }));
 
 import { useMemorySecureKeys } from "../../../__tests__/helpers/secure-keys.js";
@@ -90,7 +90,7 @@ const UPSTREAM_ITEM = {
 
 beforeEach(() => {
   secureKeys[ASSISTANT_API_KEY] = "assistant-key";
-  platformBaseUrl = "https://cloud.mycadet.ai";
+  cloudBaseUrl = "https://cloud.mycadet.ai";
   calls = [];
   process.env.CADET_MARKETING_URL = "https://marketing.test";
   process.env.CADET_WEB_URL = "https://web.test";
@@ -113,8 +113,8 @@ describe("which deployment the roadmap calls reach", () => {
     expect(calls[0].url).toBe("https://marketing.mycadet.ai/v1/roadmap");
   });
 
-  // The deployment is judged by the platform that issued the key, never by
-  // CADET_ENVIRONMENT: unset, that variable means dev to getPlatformBaseUrl
+  // The deployment is judged by the cloud that issued the key, never by
+  // CADET_ENVIRONMENT: unset, that variable means dev to getCloudBaseUrl
   // and local to every launcher, so trusting it would let exactly the assistant
   // with no label post to the real roadmap.
   test.each([
@@ -124,7 +124,7 @@ describe("which deployment the roadmap calls reach", () => {
   ])(
     "an unconfigured %s assistant refuses to touch the public roadmap",
     async (baseUrl) => {
-      platformBaseUrl = baseUrl;
+      cloudBaseUrl = baseUrl;
       delete process.env.CADET_MARKETING_URL;
       delete process.env.CADET_ENVIRONMENT;
       stubFetch({ items: [], total: 0 });
@@ -135,7 +135,7 @@ describe("which deployment the roadmap calls reach", () => {
   );
 
   test("CADET_ENVIRONMENT=production does not by itself unlock the real roadmap", async () => {
-    platformBaseUrl = "https://dev-cloud.mycadet.ai";
+    cloudBaseUrl = "https://dev-cloud.mycadet.ai";
     delete process.env.CADET_MARKETING_URL;
     process.env.CADET_ENVIRONMENT = "production";
     stubFetch({ items: [], total: 0 });
@@ -146,7 +146,7 @@ describe("which deployment the roadmap calls reach", () => {
 
   test("item links point at the deployment the item was read from", async () => {
     // Labelled staging, but authenticating against production: the link has to
-    // follow the platform, or it points at a staging page for a real item.
+    // follow the cloud, or it points at a staging page for a real item.
     process.env.CADET_ENVIRONMENT = "staging";
     delete process.env.CADET_WEB_URL;
     delete process.env.CADET_MARKETING_URL;
@@ -160,7 +160,7 @@ describe("which deployment the roadmap calls reach", () => {
   // A self-hosted platform is not in the seed table, so nothing is known about
   // it: naming its roadmap API says nothing about where its items are rendered.
   test("a self-hosted deployment must name its web origin too", async () => {
-    platformBaseUrl = "https://platform.self-hosted.example";
+    cloudBaseUrl = "https://platform.self-hosted.example";
     delete process.env.CADET_WEB_URL;
     stubFetch({ items: [], total: 0 });
 
@@ -169,7 +169,7 @@ describe("which deployment the roadmap calls reach", () => {
   });
 
   test("a self-hosted deployment works once both endpoints are named", async () => {
-    platformBaseUrl = "https://platform.self-hosted.example";
+    cloudBaseUrl = "https://platform.self-hosted.example";
     stubFetch({ items: [UPSTREAM_ITEM], total: 1 });
 
     const result = (await list({})) as { items: { url: string }[] };
@@ -178,7 +178,7 @@ describe("which deployment the roadmap calls reach", () => {
     expect(result.items[0].url).toBe("https://web.test/roadmap/dark-mode");
   });
 
-  test("a platform change mid-flight cannot fail a create that already published", async () => {
+  test("a cloud change mid-flight cannot fail a create that already published", async () => {
     delete process.env.CADET_MARKETING_URL;
     delete process.env.CADET_WEB_URL;
     globalThis.fetch = (async (
@@ -186,9 +186,9 @@ describe("which deployment the roadmap calls reach", () => {
       _init?: RequestInit,
     ): Promise<Response> => {
       // The item is published. Only now is the assistant repointed at a
-      // platform with no roadmap deployment, as a concurrent
-      // `platform_base_url` write would do.
-      platformBaseUrl = "https://platform.self-hosted.example";
+      // platform with no roadmap deployment, as a concurrent cloud base
+      // URL change would do.
+      cloudBaseUrl = "https://platform.self-hosted.example";
       return new Response(
         JSON.stringify({
           slug: "dark-mode",
@@ -207,7 +207,7 @@ describe("which deployment the roadmap calls reach", () => {
   });
 
   test("a named endpoint is honored on any deployment", async () => {
-    platformBaseUrl = "https://dev-cloud.mycadet.ai";
+    cloudBaseUrl = "https://dev-cloud.mycadet.ai";
     stubFetch({ items: [], total: 0 });
 
     await list({});

package/src/runtime/routes/__tests__/webhook-routes.test.ts

@@ -10,7 +10,7 @@ import { InternalError, UnprocessableEntityError } from "../errors.js";
 let isPlatform = false;
 let tunnelWebhooksEnabled = false;
 let config: Record<string, unknown> = {};
-let platformContextEnabled = false;
+let cloudContextEnabled = false;
 let registerCallbackRouteError: Error | undefined;
 
 let localWebhookRouteRegistered = true;
@@ -34,7 +34,7 @@ const registerLocalWebhookRouteMock = mock(
 const actualEnvRegistry = await import("../../../config/env-registry.js");
 mock.module("../../../config/env-registry.js", () => ({
   ...actualEnvRegistry,
-  getIsPlatform: () => isPlatform,
+  getIsCloud: () => isPlatform,
 }));
 
 const actualLoader = await import("../../../config/loader.js");
@@ -50,16 +50,16 @@ mock.module("../../../inbound/tunnel-webhooks-gate.js", () => ({
   isTunnelWebhooksEnabled: () => tunnelWebhooksEnabled,
 }));
 
-mock.module("../../../inbound/platform-callback-registration.js", () => ({
+mock.module("../../../inbound/cloud-callback-registration.js", () => ({
   registerCallbackRoute: registerCallbackRouteMock,
   registerLocalWebhookRoute: registerLocalWebhookRouteMock,
-  resolvePlatformCallbackRegistrationContext: async () => ({
+  resolveCloudCallbackRegistrationContext: async () => ({
     isPlatform,
-    platformBaseUrl: "https://cloud.mycadet.ai",
-    assistantId: platformContextEnabled ? "assistant-123" : "",
-    hasAssistantApiKey: platformContextEnabled,
-    authHeader: platformContextEnabled ? "Api-Key secret" : null,
-    enabled: platformContextEnabled,
+    cloudBaseUrl: "https://cloud.mycadet.ai",
+    assistantId: cloudContextEnabled ? "assistant-123" : "",
+    hasAssistantApiKey: cloudContextEnabled,
+    authHeader: cloudContextEnabled ? "Api-Key secret" : null,
+    enabled: cloudContextEnabled,
   }),
 }));
 
@@ -77,16 +77,16 @@ describe("webhooks_register callback URL resolution", () => {
     isPlatform = false;
     tunnelWebhooksEnabled = false;
     config = {};
-    platformContextEnabled = false;
+    cloudContextEnabled = false;
     registerCallbackRouteError = undefined;
     localWebhookRouteRegistered = true;
     registerCallbackRouteMock.mockClear();
     registerLocalWebhookRouteMock.mockClear();
   });
 
-  test("platform pods register with the platform gateway", async () => {
+  test("cloud pods register with the cloud gateway", async () => {
     isPlatform = true;
-    platformContextEnabled = true;
+    cloudContextEnabled = true;
 
     expect(await register({ type: "telegram" })).toEqual({
       callbackUrl: "https://tunnel.mycadet.ai/assistant-123/webhooks/telegram",
@@ -97,10 +97,10 @@ describe("webhooks_register callback URL resolution", () => {
     expect(registerLocalWebhookRouteMock).not.toHaveBeenCalled();
   });
 
-  // The bug: a local assistant that IS connected to the platform used to fall
+  // The bug: a local assistant that IS connected to the cloud used to fall
   // through to the self-hosted branch and 422 when it had no public ingress.
-  test("platform-connected local assistant with no ingress gets the platform callback URL", async () => {
-    platformContextEnabled = true;
+  test("platform-connected local assistant with no ingress gets the cloud callback URL", async () => {
+    cloudContextEnabled = true;
 
     expect(await register({ type: "telegram" })).toEqual({
       callbackUrl: "https://tunnel.mycadet.ai/assistant-123/webhooks/telegram",
@@ -118,7 +118,7 @@ describe("webhooks_register callback URL resolution", () => {
   test("tunnel-webhooks on: a pod claims the subpath and uses the published URL", async () => {
     isPlatform = true;
     tunnelWebhooksEnabled = true;
-    platformContextEnabled = true;
+    cloudContextEnabled = true;
     config = {
       ingress: { publicBaseUrl: "https://tunnel.mycadet.ai/assistant-123" },
     };
@@ -137,10 +137,10 @@ describe("webhooks_register callback URL resolution", () => {
     expect(registerCallbackRouteMock).not.toHaveBeenCalled();
   });
 
-  test("tunnel-webhooks on: a refused claim falls back to the platform", async () => {
+  test("tunnel-webhooks on: a refused claim falls back to the cloud", async () => {
     isPlatform = true;
     tunnelWebhooksEnabled = true;
-    platformContextEnabled = true;
+    cloudContextEnabled = true;
     localWebhookRouteRegistered = false;
     config = {
       ingress: { publicBaseUrl: "https://tunnel.mycadet.ai/assistant-123" },
@@ -153,10 +153,10 @@ describe("webhooks_register callback URL resolution", () => {
     expect(registerLocalWebhookRouteMock).toHaveBeenCalled();
   });
 
-  test("tunnel-webhooks on: a pod with no published URL still registers with the platform", async () => {
+  test("tunnel-webhooks on: a pod with no published URL still registers with the cloud", async () => {
     isPlatform = true;
     tunnelWebhooksEnabled = true;
-    platformContextEnabled = true;
+    cloudContextEnabled = true;
 
     expect(await register({ type: "telegram" })).toMatchObject({
       callbackUrl: "https://tunnel.mycadet.ai/assistant-123/webhooks/telegram",
@@ -165,10 +165,10 @@ describe("webhooks_register callback URL resolution", () => {
     expect(registerLocalWebhookRouteMock).not.toHaveBeenCalled();
   });
 
-  test("tunnel-webhooks on: a pod with ingress disabled falls back to the platform", async () => {
+  test("tunnel-webhooks on: a pod with ingress disabled falls back to the cloud", async () => {
     isPlatform = true;
     tunnelWebhooksEnabled = true;
-    platformContextEnabled = true;
+    cloudContextEnabled = true;
     config = { ingress: { enabled: false } };
 
     expect(await register({ type: "telegram" })).toMatchObject({
@@ -199,7 +199,7 @@ describe("webhooks_register callback URL resolution", () => {
   // A logged-in local assistant holds platform credentials for the LLM proxy,
   // so credential presence must not override an explicitly configured tunnel.
   test("a configured publicBaseUrl wins over platform connectivity", async () => {
-    platformContextEnabled = true;
+    cloudContextEnabled = true;
     config = { ingress: { publicBaseUrl: "https://abc.ngrok.io" } };
 
     expect(await register({ type: "telegram" })).toMatchObject({
@@ -214,7 +214,7 @@ describe("webhooks_register callback URL resolution", () => {
   // a tunneled platform-connected assistant already resolves to a stable
   // platform-owned URL through the ingress tier.
   test("a Tunnel-managed publicBaseUrl resolves through the ingress tier", async () => {
-    platformContextEnabled = true;
+    cloudContextEnabled = true;
     config = {
       ingress: {
         publicBaseUrl: "https://tunnel.mycadet.ai/assistant-123",
@@ -231,8 +231,8 @@ describe("webhooks_register callback URL resolution", () => {
     });
   });
 
-  test("explicitly disabled ingress is not routed around via the platform", async () => {
-    platformContextEnabled = true;
+  test("explicitly disabled ingress is not routed around via the cloud", async () => {
+    cloudContextEnabled = true;
     config = { ingress: { enabled: false } };
 
     await expect(register({ type: "telegram" })).rejects.toBeInstanceOf(
@@ -241,8 +241,8 @@ describe("webhooks_register callback URL resolution", () => {
     expect(registerCallbackRouteMock).not.toHaveBeenCalled();
   });
 
-  test("the source identifier is forwarded to the platform registration", async () => {
-    platformContextEnabled = true;
+  test("the source identifier is forwarded to the cloud registration", async () => {
+    cloudContextEnabled = true;
 
     await register({ type: "telegram", source: "@my_bot" });
 
@@ -254,7 +254,7 @@ describe("webhooks_register callback URL resolution", () => {
   });
 
   test("a failed platform registration surfaces as a 500", async () => {
-    platformContextEnabled = true;
+    cloudContextEnabled = true;
     registerCallbackRouteError = new Error(
       "Platform callback route registration failed (HTTP 502)",
     );
@@ -265,7 +265,7 @@ describe("webhooks_register callback URL resolution", () => {
   });
 
   test("a missing platform registration context surfaces as a 422", async () => {
-    platformContextEnabled = true;
+    cloudContextEnabled = true;
     registerCallbackRouteError = new Error(
       "Platform callbacks not available — missing platform registration context",
     );
@@ -276,7 +276,7 @@ describe("webhooks_register callback URL resolution", () => {
   });
 
   test("a path override replaces the derived webhook path", async () => {
-    platformContextEnabled = true;
+    cloudContextEnabled = true;
 
     expect(
       await register({ type: "custom", path: "webhooks/my-provider" }),

package/src/runtime/routes/app-management-routes.ts

@@ -528,7 +528,7 @@ async function importBundle(
   let bundleBytes: Uint8Array;
   const contentType = headers["content-type"] ?? "";
   if (contentType.includes("multipart/form-data")) {
-    // Reconstruct a Request to use the platform's multipart parser
+    // Reconstruct a Request to use the cloud's multipart parser
     const syntheticReq = new Request("http://localhost", {
       method: "POST",
       headers: { "content-type": contentType },

package/src/runtime/routes/attachment-routes.ts

@@ -207,7 +207,7 @@ async function handleMultipartUpload(
     );
   }
 
-  // Reconstruct a Request to use the platform's multipart parser.
+  // Reconstruct a Request to use the cloud's multipart parser.
   const syntheticReq = new Request("http://localhost", {
     method: "POST",
     headers: { "content-type": headers["content-type"] ?? "" },

package/src/runtime/routes/auth-routes.ts

@@ -7,17 +7,17 @@
 import { z } from "zod";
 
 import {
-  getPlatformAssistantId,
-  getPlatformBaseUrl,
-  getPlatformOrganizationId,
-  getPlatformUserId,
+  getCloudAssistantId,
+  getCloudBaseUrl,
+  getCloudOrganizationId,
+  getCloudUserId,
 } from "../../config/env.js";
-import { resolveManagedProxyContext } from "../../providers/platform-proxy/context.js";
+import { resolveCloudProxyContext } from "../../providers/cloud-proxy/context.js";
 import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 interface AuthInfoResult {
-  platformUrl: string | null;
+  cloudUrl: string | null;
   assistantId: string | null;
   organizationId: string | null;
   userId: string | null;
@@ -28,16 +28,16 @@ interface AuthInfoResult {
 async function handleAuthInfo(
   _args: RouteHandlerArgs,
 ): Promise<AuthInfoResult> {
-  const ctx = await resolveManagedProxyContext();
+  const ctx = await resolveCloudProxyContext();
 
-  const platformUrl = getPlatformBaseUrl();
-  const assistantId = getPlatformAssistantId();
-  const organizationId = getPlatformOrganizationId();
-  const userId = getPlatformUserId();
+  const cloudUrl = getCloudBaseUrl();
+  const assistantId = getCloudAssistantId();
+  const organizationId = getCloudOrganizationId();
+  const userId = getCloudUserId();
   const authenticated = ctx.enabled;
 
   const result: AuthInfoResult = {
-    platformUrl: platformUrl || null,
+    cloudUrl: cloudUrl || null,
     assistantId: assistantId || null,
     organizationId: organizationId || null,
     userId: userId || null,
@@ -45,7 +45,7 @@ async function handleAuthInfo(
   };
 
   if (!authenticated) {
-    result.message = !platformUrl
+    result.message = !cloudUrl
       ? "Platform URL not configured. Run assistant config set platform.baseUrl <url>"
       : "Assistant API key not found. Store one with: assistant keys set credential/cadet/assistant_api_key <key>";
   }
@@ -67,7 +67,7 @@ export const ROUTES: RouteDefinition[] = [
       "Returns platform identity and authentication status for this assistant.",
     tags: ["auth"],
     responseBody: z.object({
-      platformUrl: z.string().nullable(),
+      cloudUrl: z.string().nullable(),
       assistantId: z.string().nullable(),
       organizationId: z.string().nullable(),
       userId: z.string().nullable(),

package/src/runtime/routes/avatar-routes.ts

@@ -32,9 +32,6 @@ import {
   ensureAvatarRasterPath,
 } from "../../avatar/ensure-raster.js";
 import type { CharacterTraits } from "../../avatar/traits-png-sync.js";
-import { setPlatformBaseUrl } from "../../config/env.js";
-import { credentialKey } from "../../security/credential-key.js";
-import { getSecureKeyAsync } from "../../security/secure-keys.js";
 import { detectMediaType } from "../../tools/shared/filesystem/image-read.js";
 import { generateAvatarImage } from "../../tools/system/avatar-generator.js";
 import { getLogger } from "../../util/logger.js";
@@ -178,17 +175,6 @@ async function handleGenerateAvatar({ body, headers }: RouteHandlerArgs) {
     throw new BadRequestError("description is required");
   }
 
-  // Rehydrate platform base URL from credential store
-  try {
-    const key = credentialKey("cadet", "platform_base_url");
-    const persisted = await getSecureKeyAsync(key);
-    if (persisted) {
-      setPlatformBaseUrl(persisted);
-    }
-  } catch {
-    // Non-fatal
-  }
-
   const result = await generateAvatarImage(description);
   if (result.isError || !result.pngBuffer) {
     throw new ServiceUnavailableError(result.content);

package/src/runtime/routes/background-wake-routes.ts

@@ -20,7 +20,7 @@ import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 /** The scheduler and heartbeat surface the drain-due lease needs. */
 type BackgroundWakeRuntime = {
   scheduler: Pick<SchedulerHandle, "runOnce" | "runDueWorkOnce">;
-  heartbeat: Pick<HeartbeatService, "nextRunAt" | "runManagedWakeIfDue">;
+  heartbeat: Pick<HeartbeatService, "nextRunAt" | "runCloudWakeIfDue">;
 };
 
 const PREPARE_SLEEP_DEFER_WINDOW_MS = 60_000;
@@ -127,7 +127,7 @@ function parseDrainDueBody(body: Record<string, unknown>): DrainDueRequest {
 
 async function defaultRenewWakeLease(leaseId: string): Promise<unknown> {
   const { renewBackgroundWakeLease } =
-    await import("../../background-wake/platform-client.js");
+    await import("../../background-wake/cloud-client.js");
   return renewBackgroundWakeLease(leaseId);
 }
 
@@ -135,7 +135,7 @@ async function defaultCompleteWakeLease(
   args: Parameters<CompleteWakeLease>[0],
 ): Promise<unknown> {
   const { completeBackgroundWakeLease } =
-    await import("../../background-wake/platform-client.js");
+    await import("../../background-wake/cloud-client.js");
   return completeBackgroundWakeLease(args);
 }
 
@@ -242,7 +242,7 @@ async function performDrainDue(
 
   if (heartbeatDue) {
     if (hasStartBudget(request.deadlineAt)) {
-      await runtime.heartbeat.runManagedWakeIfDue({
+      await runtime.heartbeat.runCloudWakeIfDue({
         now,
         toleranceMs: HEARTBEAT_DUE_TOLERANCE_MS,
         scheduledFor: request.startedAt,

package/src/runtime/routes/channel-availability-routes.ts

@@ -41,11 +41,11 @@ const BASE_AVAILABLE_CHANNELS: readonly ChannelId[] = [
 ] as const;
 
 /**
- * Best-effort check that email is configured for this assistant: a managed
- * inbox registered on the platform, or a "your own" provider credential
- * (whose gateway webhook routes carry inbound just as the managed pipeline
+ * Best-effort check that email is configured for this assistant: a cloud
+ * inbox registered on the cloud, or a "your own" provider credential
+ * (whose gateway webhook routes carry inbound just as the cloud pipeline
  * does). An unavailable platform is treated as "no inbox": we prefer to
- * under-report than block the entire Contacts page when the platform is
+ * under-report than block the entire Contacts page when the cloud is
  * briefly unreachable.
  *
  * Fresh, preserving this route's long-standing live-read-per-request

package/src/runtime/routes/client-routes.ts

@@ -95,7 +95,7 @@ export const ROUTES: RouteDefinition[] = [
       // — fail-closed is the right default for this security boundary.
       // Dev-bypass mode (DISABLE_HTTP_AUTH=true, mirroring
       // require-bound-guardian.ts) preserves the previous "return all" behavior
-      // for platform-managed deployments where the platform handles auth.
+      // for cloud-managed deployments where the cloud handles auth.
       const callerPrincipalId = headers?.["x-cadet-actor-principal-id"];
       const filtered = isHttpAuthDisabled()
         ? clients
@@ -274,8 +274,8 @@ export const ROUTES: RouteDefinition[] = [
       // spoof that desktop. Clients with no stored `actorPrincipalId` (legacy
       // SSE subscribers, service-gateway tokens) never match: fail-closed, the
       // same posture as the listing filter above. Dev-bypass mode
-      // (DISABLE_HTTP_AUTH=true) skips the check for platform-managed
-      // deployments where the platform handles auth.
+      // (DISABLE_HTTP_AUTH=true) skips the check for cloud-managed
+      // deployments where the cloud handles auth.
       if (!isHttpAuthDisabled()) {
         const callerPrincipalId = headers?.["x-cadet-actor-principal-id"];
         const ownerPrincipalId = client.actorPrincipalId;
@@ -371,8 +371,8 @@ export const ROUTES: RouteDefinition[] = [
       // spoof that tab. Clients with no stored `actorPrincipalId` (legacy SSE
       // subscribers, service-gateway tokens) never match: fail-closed, the
       // same posture as `report_client_presence`. Dev-bypass mode
-      // (DISABLE_HTTP_AUTH=true) skips the check for platform-managed
-      // deployments where the platform handles auth.
+      // (DISABLE_HTTP_AUTH=true) skips the check for cloud-managed
+      // deployments where the cloud handles auth.
       if (!isHttpAuthDisabled()) {
         const callerPrincipalId = headers?.["x-cadet-actor-principal-id"];
         const ownerPrincipalId = client.actorPrincipalId;

package/src/runtime/routes/cloud-credentials.ts

@@ -0,0 +1,45 @@
+/**
+ * The credential Cadet Cloud provisions onto a cloud assistant pod for
+ * its own use: the API key the daemon authenticates to the cloud LLM proxy
+ * with.
+ *
+ * The cloud writes it over `POST /v1/secrets`, and the daemon, the
+ * gateway, and CES read it straight out of the vault. The user never sets it
+ * through the credentials API and can do nothing useful with it there, so
+ * that API treats it as neither readable nor writable: omitted from listings,
+ * and refused by inspect, reveal, set, and delete, whatever the calling
+ * principal.
+ *
+ * The key spends inference on Cadet's account; the host it is sent to
+ * resolves from config or the `CADET_CLOUD_URL` environment variable, so
+ * there is no stored URL credential to guard alongside it.
+ */
+// The cloud pushes the pre-rebrand display name ("cadet:*"); the
+// canonical storage service is "cadet".
+const MANAGED_PROXY_CREDENTIALS = [
+  { service: "cadet", field: "assistant_api_key" },
+] as const;
+
+export function isPlatformCloudCredential(
+  service: string,
+  field: string,
+): boolean {
+  return MANAGED_PROXY_CREDENTIALS.some(
+    (c) => c.service === service && c.field === field,
+  );
+}
+
+/** What a caller was trying to do with a cloud credential. */
+export type PlatformCloudCredentialAction = "read" | "change";
+
+/** Message the credentials API refuses one of these with. */
+export function platformCloudCredentialRefusal(
+  service: string | undefined,
+  field: string | undefined,
+  action: PlatformCloudCredentialAction,
+): string {
+  const name = service && field ? `${service}:${field}` : "This credential";
+  const verb =
+    action === "read" ? "inspected or revealed" : "changed or deleted";
+  return `${name} is provisioned and owned by Cadet Cloud. It cannot be ${verb} through the credentials API.`;
+}